Help with svchost.exe virus; random audio files

[hkimble2]

Ok, SystemLook.txt:

 

SystemLook 30.07.11 by jpshortstuff

Log created at 16:52 on 20/01/2014 by H Kimble

Administrator - Elevation successful

 

========== filefind ==========

 

Searching for "*rpcss.dll*"

C:\ProgramData\Malwarebytes' Anti-Malware (portable)\rpcss.dll_r.mbam --a---- 509440 bytes [05:51 28/12/2013] [01:41 14/07/2009] 7266972E86890E2B30C0C322E906B027

C:\Users\All Users\Malwarebytes' Anti-Malware (portable)\rpcss.dll_r.mbam --a---- 509440 bytes [05:51 28/12/2013] [01:41 14/07/2009] 7266972E86890E2B30C0C322E906B027

C:\Windows\System32\rpcss.dll --a---- 512512 bytes [22:55 20/06/2011] [13:27 20/11/2010] C6ADBA7AB4146D91873D3A5D4B198954

C:\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7600.16385_none_c5bfcda3579104e3\rpcss.dll --a---- 509440 bytes [00:00 14/07/2009] [01:41 14/07/2009] 7266972E86890E2B30C0C322E906B027

C:\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_c7f0e16b547f887d\rpcss.dll --a---- 512000 bytes [22:55 20/06/2011] [13:27 20/11/2010] 5C627D1B1138676C0A7AB2C2C190D123

C:\Windows\winsxs\Backup\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_c7f0e16b547f887d_rpcss.dll_fd3e269b --a---- 512000 bytes [21:12 18/09/2011] [11:15 18/09/2011] 5C627D1B1138676C0A7AB2C2C190D123

C:\Windows.old\Windows\System32\rpcss.dll --a---- 719872 bytes [11:28 09/07/2009] [07:11 11/04/2009] CF8B9A3A5E7DC57724A89D0C3E8CF9EF

C:\Windows.old\Windows\System32\en-US\rpcss.dll.mui --a---- 4096 bytes [15:13 02/11/2006] [15:13 02/11/2006] 3427F7881A3234C8D6B161CDD047197E

C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-c..qfe-rpcss.resources_31bf3856ad364e35_6.0.6000.16386_en-us_a25877e9de938b1b\rpcss.dll.mui --a---- 4096 bytes [15:13 02/11/2006] [15:13 02/11/2006] 3427F7881A3234C8D6B161CDD047197E

C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.0.6000.16830_none_c3e2cce1f92f2ca2\rpcss.dll --a---- 724992 bytes [16:55 15/04/2009] [04:40 03/03/2009] 007F8DE7AC0F9386C3FD2EC7DC87C37A

C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.0.6000.21023_none_c47a129912422fc2\rpcss.dll --a---- 724992 bytes [16:55 15/04/2009] [04:35 03/03/2009] 54FF562C2710BB610B019D723B16FB2A

C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.0.6001.18000_none_c5e9777ff63d6f72\rpcss.dll --a---- 713728 bytes [02:51 21/01/2008] [02:51 21/01/2008] FF27BE0BA7B3C48D5C99AFCB56D436C2

C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.0.6001.18226_none_c5d9dd2ff64839ac\rpcss.dll --a---- 718336 bytes [16:55 15/04/2009] [04:57 03/03/2009] 52CDADE8289FF21F1F2215FF51A5F36C

C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.0.6001.22389_none_c6259b510f93cd21\rpcss.dll --a---- 717824 bytes [16:55 15/04/2009] [04:59 03/03/2009] 857E04C16007E60FCC0803239C853E78

C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.0.6002.18005_none_c7d4f08bf35f3abe\rpcss.dll --a---- 719872 bytes [11:28 09/07/2009] [07:11 11/04/2009] CF8B9A3A5E7DC57724A89D0C3E8CF9EF

C:\Windows.old\Windows\winsxs\Backup\amd64_microsoft-windows-c..qfe-rpcss.resources_31bf3856ad364e35_6.0.6000.16386_en-us_a25877e9de938b1b_rpcss.dll.mui_78e56052 --a---- 4096 bytes [15:15 02/11/2006] [15:14 02/11/2006] 3427F7881A3234C8D6B161CDD047197E

C:\Windows.old\Windows\winsxs\Backup\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.0.6002.18005_none_c7d4f08bf35f3abe_rpcss.dll_fd3e269b --a---- 719872 bytes [03:26 10/07/2009] [22:54 09/07/2009] CF8B9A3A5E7DC57724A89D0C3E8CF9EF

 

-= EOF =-

[Maniac]

Please follow the instructions to scan and repair your system files:

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

When is ready, please generate a new fresh SystemLook log file.

[hkimble2]

I've tried to run the sfc /scannow several times in normal and safe mode with networking.  I keep getting the "Windows Resource Protection could not perform the requested operation" error after Verification 10% complete.  The Windows Modules Installer service is enabled and set to manual, but I still can't get the scan to run past 10%.

 

Is there anything else I can do?

[Maniac]

Please manually delete ComboFix, download a new fresh copy and re-run it.

[AdvancedSetup]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!